CVE-2026-19958
MediumCVSS 6.3Exploitation Probability (EPSS)
Low risk14th percentile - higher than 14% of all known CVEs
Summary
A security flaw was discovered in iatsiuk pptr-mcp up to 0.2.7. It affects the executeCode function in src/vm-executor.ts of the execute Tool component. The manipulation results in code injection. The attack can be launched remotely and the exploit is public.
Risk Assessment
Remote execution of arbitrary code in the application context, potentially leading to system compromise. Public exploit increases risk.
Recommendation
Update to a patched version if available. Restrict access to the service from trusted sources.
Original NVD description (English source)
A security flaw has been discovered in iatsiuk pptr-mcp up to 0.2.7. The impacted element is the function executeCode of the file src/vm-executor.ts of the component execute Tool. The manipulation results in code injection. The attack may be launched remotely. The exploit has been released to the public and may be used for attacks. The project was informed of the problem early through an issue report but has not responded yet.